GCHQ cannot find thousands of USB sticks. Could you find yours?

· · Security

Think about every device that holds your business's data. The laptops on desks and the ones people take home. The old laptop in the cupboard that nobody wiped. The USB stick the accountant brought in at year end. The external drive someone used for a "temporary" backup in 2023. The phones with work email on them. Could you write that list down now, and say where each item is?

If the honest answer is "roughly", you are in large company. That now includes GCHQ.

What happened

On 29 October the Investigatory Powers Commissioner published his annual report for 2025. Among its findings: GCHQ "still cannot tell me what has happened to removable media that may hold sensitive data, years after I first raised it with them." The agency puts the losses "in the thousands", covering USB sticks, external hard drives, discs, and memory cards. The report does not claim any of them reached the wrong hands.

The useful detail is in GCHQ's own response. A spokesperson told The Record that its "management system for removable media was previously not sufficiently robust to effectively track the items that were registered for use." The items were registered. The register existed. What failed was keeping it true as devices moved around. GCHQ is now putting in automated asset tracking.

This is not a story about careless people. GCHQ employs some of the best security staff in the country. The point is that a device list decays on its own unless something keeps checking it against reality, and that is just as true in a 30-person firm.

Why your business needs the list too

For most businesses the risk is not espionage. It is personal data. A lost laptop or USB stick holding client records, payroll, or HR files is a potential personal data breach under UK GDPR. You have to assess the risk to the people involved and, if they are at risk, report it to the Information Commissioner's Office within 72 hours. If the device was encrypted, that assessment is usually short. If you do not know which device it was, or what was on it, it is not.

The list matters in other places too. Every one of the five Cyber Essentials controls, from firewalls to security updates, applies to your devices. You cannot honestly answer for devices you do not know about. Insurance proposal forms ask similar questions, and an answer that turns out to be wrong after a claim is a bad time to find out.

The National Cyber Security Centre puts it plainly in its asset management guidance: asset management "is not about making lists or databases that never get used." The list has to be something you check, not something you made once.

What to do

Start from systems that already know. Microsoft 365, Google Workspace, and any device management tool you use will list devices that have signed in. Compare that with purchase records and what is physically in the office. The gaps between the three are your first findings.

Record five things per device. Who has it, what kind of data it holds, whether it is encrypted, when it was last seen, and when it is due for replacement. The "last seen" date matters most. It is what tells you an entry has gone stale. BitLocker on Windows and FileVault on Mac are the built-in encryption tools to check for.

Decide whether you need USB storage at all. Most businesses that share files through Microsoft 365 or Google Drive no longer do. If you do, buy encrypted drives, give each one a label and an owner, and block unregistered USB storage through device policy.

Tie the list to joiners and leavers. A leaver is the moment a device is most likely to drift off the list. Add "kit returned and checked against the list" to your leaver process, and make one named person responsible for confirming it.

Keep proof of disposal. When old kit goes to a recycler, the NCSC's decommissioning guidance says to keep evidence the work was done properly, usually as certificates. Then update the list. A device that was disposed of, with a certificate to prove it, is a closed entry. A device that simply disappeared is an open question.

Check it on a schedule. Once a quarter is enough for most small firms: compare the list against the sign-in records, chase anything not seen recently, and note the date you did it.

Three questions for the boss to ask

If you run the business rather than the IT, you do not need to build this yourself. Ask whoever looks after your computers:

  1. How many devices hold our data, and when was that number last checked?
  2. Are they all encrypted, and how do you know?
  3. When someone leaves, who confirms their kit came back?

Clear answers to those three are worth more than any policy document.

How Steelwise can help

Building a device list that matches reality, and that will stand up to an insurer or a Cyber Essentials assessor, is a short piece of security advisory work. Get in touch if you would like help with yours.

Further reading

← All filings

We use cookies to understand how visitors use this site. More information.